Unraid OS 7.2.9 Now Available

Unraid OS 7.2.9 is a targeted maintenance release for the 7.2 branch. It includes PHP security fixes, an Unraid API update from 4.36.1 to 4.37.7, and updates addressing the compromised CA certificates referenced in the eMudhra certificate-compromise report from Palo Alto Networks Unit 42. The Linux kernel version is unchanged from 7.2.8.

We highly recommend updating to the latest stable release, Unraid OS 7.3.4, for its newer kernel and broader package security updates.

Security

• PHP 8.4.23 → 8.4.27 addresses multiple CVEs (CVE-2026-6103, CVE-2026-7260, CVE-2026-17543, CVE-2026-17544, CVE-2026-17545, CVE-2026-91765, CVE-2026-91766, CVE-2026-91769, CVE-2026-109618, CVE-2026-109619)
• CA certificates 20260717 → 20261020 addresses the compromised CA certificates referenced in the Unit 42 report

Unraid API

The Unraid API is updated from 4.36.1 to 4.37.7. Its bundled Node.js runtime is updated to 22.23.4, which resolves the Node.js certificate-compromise issue. See the full API comparison.

Security Advisory: Additional Potential Vulnerabilities

Updating to 7.2.9 alone should not be interpreted as resolving every potential open security issue. We recommend updating to the latest stable release, Unraid OS 7.3.4, for its newer kernel and broader package security updates.

Unraid OS 7.2.9 is a targeted maintenance release containing PHP security fixes, CA-certificate updates, and Unraid API fixes and security hardening. It does not include broader distro-package or kernel security updates available in newer releases on the 7.3.x branch.

As of October 23, 2026, upstream package advisories identify 115 potential CVEs associated with package versions included in this release:

• Network transfers and DNS — 42: curl (30) and BIND (12)
• Encryption and secure connections — 25: OpenSSL (23), libssh (1), and p11-kit (1)
• Graphical components — 29: xorg-server (11), libXi (8), libX11 (4), libXfont2 (2), libXtst (2), libXpm (1), and libXrender (1)
• File sharing — 6: Samba (6)
• Other libraries and system utilities — 10: libpcap (5), util-linux (4), and libpng (1)

Additional security advisories cover libarchive, libxml2, OpenSSH, PCRE2, rsync, wpa_supplicant, and xz without listing specific CVE identifiers. Separate vulnerability-database checks identify 55 potential package CVEs that may overlap with the 115 above; these totals should not be added together.

Newer upstream kernel releases also contain security fixes not included in 7.2.9.

Base Distro

4 packages updated:

• ca-certificates 20260717 → 20261020
• dynamix.unraid.net (Unraid API) 4.36.1 → 4.37.7
• libvirt-php 0.5.8-8.4.23_LT → 0.5.8-8.4.27_LT
• php 8.4.23-1_LT → 8.4.27-1_LT

Known Issues

No new release-specific known issues are documented. See the Unraid OS 7.2.8 release notes for issues that may still apply.

Rolling Back

No release-specific rollback warnings or compatibility limits are documented.

Upgrading

For step-by-step instructions, see Updating Unraid. Questions about your license? See the Licensing FAQ.